From 369a091884077225ae8e8731fd8e8c93e5683dcc Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Wed, 10 Jun 2026 02:09:40 -0700 Subject: mtd: cfi_cmdset_0001: silence spurious suspend warning on shutdown cfi_intelext_reboot() puts each chip into FL_SHUTDOWN (array mode) via the reboot notifier so the bootloader can read the flash on the next boot. If pm_suspend then runs on the same chip during the shutdown sequence, cfi_intelext_suspend() falls into the default branch and prints: Flash device refused suspend due to active operation (state 20) The chip is not active; it is already shut down. Treat FL_SHUTDOWN the same as FL_PM_SUSPENDED in the suspend switch so nothing is done and no warning is emitted. Reproduced on every boot of the QEMU 'virt' arm64 machine, which exposes two Intel-Sharp pflash chips. Signed-off-by: Breno Leitao Signed-off-by: Miquel Raynal --- drivers/mtd/chips/cfi_cmdset_0001.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c index b73596a8e021..6049ba2d6bcb 100644 --- a/drivers/mtd/chips/cfi_cmdset_0001.c +++ b/drivers/mtd/chips/cfi_cmdset_0001.c @@ -2565,6 +2565,12 @@ static int cfi_intelext_suspend(struct mtd_info *mtd) ret = -EAGAIN; break; case FL_PM_SUSPENDED: + case FL_SHUTDOWN: + /* + * Already suspended, or put into array mode by the + * reboot notifier ahead of an imminent power-off. + * Either way there is nothing to do. + */ break; } mutex_unlock(&chip->mutex); -- cgit v1.2.3 From d276783e490d73536135f90f96c5875f263481ab Mon Sep 17 00:00:00 2001 From: Ethan Nelson-Moore Date: Sat, 13 Jun 2026 14:10:28 -0700 Subject: mtd: maps: correct CONFIG_MTD_COMPLEX_MAPPINGS macro name in comment A comment in drivers/mtd/maps/map_funcs.c incorrectly refers to CONFIG_COMPLEX_MAPPINGS instead of CONFIG_MTD_COMPLEX_MAPPINGS. Correct it. Discovered while searching for CONFIG_* symbols referenced in code but not defined in any Kconfig file. Signed-off-by: Ethan Nelson-Moore Signed-off-by: Miquel Raynal --- drivers/mtd/maps/map_funcs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/maps/map_funcs.c b/drivers/mtd/maps/map_funcs.c index 1a4add9e119a..b0054933cae0 100644 --- a/drivers/mtd/maps/map_funcs.c +++ b/drivers/mtd/maps/map_funcs.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* - * Out-of-line map I/O functions for simple maps when CONFIG_COMPLEX_MAPPINGS + * Out-of-line map I/O functions for simple maps when CONFIG_MTD_COMPLEX_MAPPINGS * is enabled. */ -- cgit v1.2.3 From df6f582df3377af316a60ca8ee0d590b2d03924d Mon Sep 17 00:00:00 2001 From: Guangshuo Li Date: Sun, 5 Jul 2026 11:31:07 +0800 Subject: mtd: intel-dg: Fix runtime PM error path in probe intel_dg_mtd_probe() allocates region names before enabling runtime PM and before calling pm_runtime_resume_and_get(). If kasprintf() fails while building a region name, the error path jumps to err, which calls pm_runtime_put(). At that point there has not been a successful pm_runtime_resume_and_get() call to balance, so the runtime PM usage count can underflow. Jump to err_norpm from the kasprintf() failure path, as the runtime PM reference has not been acquired yet. Fixes: 779c59274d03 ("mtd: intel-dg: Fix accessing regions before setting nregions") Signed-off-by: Guangshuo Li Reviewed-by: Raag Jadav Signed-off-by: Miquel Raynal --- drivers/mtd/devices/mtd_intel_dg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/devices/mtd_intel_dg.c b/drivers/mtd/devices/mtd_intel_dg.c index f2fa8f68d190..a566e86eb5e3 100644 --- a/drivers/mtd/devices/mtd_intel_dg.c +++ b/drivers/mtd/devices/mtd_intel_dg.c @@ -780,7 +780,7 @@ static int intel_dg_mtd_probe(struct auxiliary_device *aux_dev, dev_name(&aux_dev->dev), invm->regions[i].name); if (!name) { ret = -ENOMEM; - goto err; + goto err_norpm; } nvm->regions[n].name = name; -- cgit v1.2.3 From e9290031f736e99ad17c25c00311c92c266843b7 Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Wed, 8 Jul 2026 09:49:06 +0800 Subject: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer[8] to locate the image information block inside the current erase block, then uses the image information region_count to walk entries from a fixed local array. The footer offset and region count come from flash contents and are not checked against the erase block or the local image-info array before use. Reject v2 entries whose image information offset would underflow the erase block calculation, and reject region counts that cannot fit in the local image-info array before walking region entries. Fixes: b7cf5e2830bb ("mtd: afs: add v2 partition parsing") Cc: stable@vger.kernel.org Signed-off-by: Pengpeng Hou Acked-by: Linus Walleij Signed-off-by: Miquel Raynal --- drivers/mtd/parsers/afs.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/mtd/parsers/afs.c b/drivers/mtd/parsers/afs.c index 26116694c821..7ab3d50f565e 100644 --- a/drivers/mtd/parsers/afs.c +++ b/drivers/mtd/parsers/afs.c @@ -235,6 +235,9 @@ static int afs_parse_v2_partition(struct mtd_info *mtd, pr_debug("Parsing v2 partition @%08x-%08x\n", off, off + mtd->erasesize); + if (mtd->erasesize < sizeof(footer)) + return -EINVAL; + /* First read the footer */ ptr = off + mtd->erasesize - sizeof(footer); ret = mtd_read(mtd, ptr, sizeof(footer), &sz, (u_char *)footer); @@ -245,6 +248,8 @@ static int afs_parse_v2_partition(struct mtd_info *mtd, } name = (char *) &footer[0]; version = footer[9]; + if (footer[8] > mtd->erasesize - sizeof(footer)) + return -EINVAL; ptr = off + mtd->erasesize - sizeof(footer) - footer[8]; pr_debug("found image \"%s\", version %08x, info @%08x\n", @@ -278,6 +283,8 @@ static int afs_parse_v2_partition(struct mtd_info *mtd, entrypoint = imginfo[pad]; attributes = imginfo[pad+1]; region_count = imginfo[pad+2]; + if (region_count > (ARRAY_SIZE(imginfo) - pad - 3) / 4) + return -EINVAL; block_start = imginfo[20]; block_end = imginfo[21]; -- cgit v1.2.3 From 779aa4c66a96bf43d2d62982ea1a9096a9128d87 Mon Sep 17 00:00:00 2001 From: Ruoyu Wang Date: Wed, 8 Jul 2026 22:33:55 +0800 Subject: mtd: mtdswap: Avoid freeing registered blktrans device twice In mtdswap_add_mtd(), debugfs setup failure after successful blktrans registration can free mbd_dev twice. add_mtd_blktrans_dev() initializes the blktrans device reference and publishes the disk. Once that succeeds, del_mtd_blktrans_dev() tears the disk down and drops the blktrans reference; when that reference reaches zero, blktrans_dev_release() frees the mtd_blktrans_dev. The debugfs failure path called del_mtd_blktrans_dev(mbd_dev), then fell through the common cleanup label and called kfree(mbd_dev) again. Clear the local pointer after deregistration so the common cleanup can still release the mtdswap state without freeing the blktrans object twice. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: e8e3edb95ce6 ("mtd: create per-device and module-scope debugfs entries") Signed-off-by: Ruoyu Wang Signed-off-by: Miquel Raynal --- drivers/mtd/mtdswap.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/mtdswap.c b/drivers/mtd/mtdswap.c index 866933fc8426..533b8948918c 100644 --- a/drivers/mtd/mtdswap.c +++ b/drivers/mtd/mtdswap.c @@ -1450,6 +1450,7 @@ static void mtdswap_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd) debugfs_failed: del_mtd_blktrans_dev(mbd_dev); + mbd_dev = NULL; cleanup: mtdswap_cleanup(d); -- cgit v1.2.3 From 956e7da12c114f13c63d126ab1d79c3b6a819060 Mon Sep 17 00:00:00 2001 From: Xu Rao Date: Mon, 13 Jul 2026 13:22:03 +0800 Subject: mtd: mtdoops: free page bitmap when the backing MTD is removed mtdoops_notify_add() allocates oops_page_used when the configured MTD device is registered. mtdoops_notify_remove() detaches from that device but leaves the bitmap allocated. If the same MTD device is later registered again, the add path allocates a new bitmap and overwrites the old pointer, leaking one vmalloc allocation per remove/add cycle. This is only visible when the backing MTD device can disappear and be registered again while mtdoops remains loaded, so the usual static MTD case does not expose it. Free the bitmap after unregistering the dumper and flushing the pending workers, then clear the pointer and page count before a later attach can allocate fresh state. Clearing the pointer also keeps the module exit path from freeing the same bitmap a second time after a remove event. Fixes: be95745f0167 ("mtd: mtdoops: keep track of used/unused pages in an array") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao Signed-off-by: Miquel Raynal --- drivers/mtd/mtdoops.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c index 39df7ce8f55f..1da7ef06a7a9 100644 --- a/drivers/mtd/mtdoops.c +++ b/drivers/mtd/mtdoops.c @@ -392,6 +392,9 @@ static void mtdoops_notify_remove(struct mtd_info *mtd) cxt->mtd = NULL; flush_work(&cxt->work_erase); flush_work(&cxt->work_write); + vfree(cxt->oops_page_used); + cxt->oops_page_used = NULL; + cxt->oops_pages = 0; } -- cgit v1.2.3 From 355efa360ba3b9ed242f444c69fbafa84a29a525 Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 13 Jul 2026 16:17:22 -0700 Subject: mtd: mpc5121_nfc: use platform for irq and ioremap Replace the open-coded of_address_to_resource() plus devm_request_mem_region() and devm_ioremap() sequence with a single devm_platform_ioremap_resource() call, which folds the resource lookup, region reservation and mapping into one step and returns an ERR_PTR on failure, checked with IS_ERR() and propagated via PTR_ERR(). Switch IRQ acquisition from irq_of_parse_and_map() to platform_get_irq(), which only retrieves the interrupt the OF/platform core has already set up rather than transferring mapping ownership to the driver. Drop the now unneeded of_irq.h include. This is behaviorally equivalent: the driver already reserved the region with devm_request_mem_region(), so the non-overlapping reg requirement of devm_platform_ioremap_resource() was already satisfied. Drop the now-unused regs_paddr / regs_size locals, which previously only fed the open-coded request/ioremap calls. Keep the linux/of_address.h include, as of_iomap() is still used elsewhere in the driver. Built for PowerPC (mpc512x_defconfig + CONFIG_MTD_NAND_MPC5121_NFC) with LLVM=1; drivers/mtd/nand/raw/mpc5121_nfc.o compiles cleanly. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/mpc5121_nfc.c | 39 ++++++++++++-------------------------- 1 file changed, 12 insertions(+), 27 deletions(-) diff --git a/drivers/mtd/nand/raw/mpc5121_nfc.c b/drivers/mtd/nand/raw/mpc5121_nfc.c index 97b4e7f3e1bb..e6594548b7e0 100644 --- a/drivers/mtd/nand/raw/mpc5121_nfc.c +++ b/drivers/mtd/nand/raw/mpc5121_nfc.c @@ -23,7 +23,6 @@ #include #include #include -#include #include #include @@ -618,14 +617,14 @@ static int mpc5121_nfc_probe(struct platform_device *op) struct clk *clk; struct device *dev = &op->dev; struct mpc5121_nfc_prv *prv; - struct resource res; struct mtd_info *mtd; struct nand_chip *chip; - unsigned long regs_paddr, regs_size; const __be32 *chips_no; + void __iomem *regs; int resettime = 0; int retval = 0; int rev, len; + int irq; /* * Check SoC revision. This driver supports only NFC @@ -637,6 +636,14 @@ static int mpc5121_nfc_probe(struct platform_device *op) return -ENXIO; } + regs = devm_platform_ioremap_resource(op, 0); + if (IS_ERR(regs)) + return PTR_ERR(regs); + + irq = platform_get_irq(op, 0); + if (irq < 0) + return irq; + prv = devm_kzalloc(dev, sizeof(*prv), GFP_KERNEL); if (!prv) return -ENOMEM; @@ -660,17 +667,7 @@ static int mpc5121_nfc_probe(struct platform_device *op) return retval; } - prv->irq = irq_of_parse_and_map(dn, 0); - if (!prv->irq) { - dev_err(dev, "Error mapping IRQ!\n"); - return -EINVAL; - } - - retval = of_address_to_resource(dn, 0, &res); - if (retval) { - dev_err(dev, "Error parsing memory region!\n"); - return retval; - } + prv->irq = irq; chips_no = of_get_property(dn, "chips", &len); if (!chips_no || len != sizeof(*chips_no)) { @@ -678,19 +675,7 @@ static int mpc5121_nfc_probe(struct platform_device *op) return -EINVAL; } - regs_paddr = res.start; - regs_size = resource_size(&res); - - if (!devm_request_mem_region(dev, regs_paddr, regs_size, DRV_NAME)) { - dev_err(dev, "Error requesting memory region!\n"); - return -EBUSY; - } - - prv->regs = devm_ioremap(dev, regs_paddr, regs_size); - if (!prv->regs) { - dev_err(dev, "Error mapping memory region!\n"); - return -ENOMEM; - } + prv->regs = regs; mtd->name = "MPC5121 NAND"; chip->legacy.dev_ready = mpc5121_nfc_dev_ready; -- cgit v1.2.3 From b759d5bb6265419344ee9729fd0dc07ad85719d8 Mon Sep 17 00:00:00 2001 From: zhouminqiang Date: Thu, 16 Jul 2026 21:14:32 +0800 Subject: mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() mtd_add_partition() does not reject the special offset value MTDPART_OFS_RETAIN (-3), which leads to a WARN_ON in add_mtd_device() when called through the BLKPG ioctl on NAND devices. The RETAIN value depends on cur_offset being the end of the previous partition, but in the dynamic partition path cur_offset equals the offset argument itself, causing undefined behavior. Commit 5daa7b21496a ("mtd: prepare partition add and del functions for ioctl requests") introduced mtd_add_partition() and correctly rejected MTDPART_OFS_APPEND (-1) and MTDPART_OFS_NXTBLK (-2), since those special offsets rely on cur_offset tracking the previous partition's end. However, commit 1a31368bf92e ("mtd: add a flags for partitions which should just leave smth. after them") later added MTDPART_OFS_RETAIN (-3) for the static partition table path without updating mtd_add_partition() to also reject this value. With offset=-3 passed via BLKPG, the RETAIN size calculation in allocate_partition() underflows (parent_size - 0xFFFFFFFFFFFFFFFD = parent_size + 3). If the underflow result does not appear to leave enough space, allocate_partition() jumps to out_register via goto, skipping erasesize initialization. This results in erasesize=0, which triggers: WARN_ON((!mtd->erasesize || !master->_erase) && !(mtd->flags & MTD_NO_ERASE)) in add_mtd_device(). If the underflow result appears to leave enough space, a bogus partition size is calculated, but the "out of reach" sanity check catches the invalid offset and creates a disabled empty partition (offset=0, size=0) instead of returning an error. Fix this by adding MTDPART_OFS_RETAIN to the rejection list in mtd_add_partition(), consistent with the existing handling of APPEND and NXTBLK. Fixes: 1a31368bf92e ("mtd: add a flags for partitions which should just leave smth. after them") Signed-off-by: zhouminqiang Reviewed-by: Zhihao Cheng Signed-off-by: Miquel Raynal --- drivers/mtd/mtdpart.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c index 795a94e6b482..11cab777a1ac 100644 --- a/drivers/mtd/mtdpart.c +++ b/drivers/mtd/mtdpart.c @@ -255,7 +255,8 @@ int mtd_add_partition(struct mtd_info *parent, const char *name, /* the direct offset is expected */ if (offset == MTDPART_OFS_APPEND || - offset == MTDPART_OFS_NXTBLK) + offset == MTDPART_OFS_NXTBLK || + offset == MTDPART_OFS_RETAIN) return -EINVAL; if (length == MTDPART_SIZ_FULL) -- cgit v1.2.3 From 94d32f1ace8ee3ef3537ac6c8e71b76a418a4762 Mon Sep 17 00:00:00 2001 From: Julian Braha Date: Wed, 22 Jul 2026 23:06:18 +0100 Subject: mtd: maps: remove dead select of MTD_CFI_BE_BYTE_SWAP 'select' does not work on config options in a 'choice', so currently it is possible to enable MTD_PHYSMAP_IXP4XX without MTD_CFI_BE_BYTE_SWAP. From a previous conversation, it was decided to remove the select entirely: https://lore.kernel.org/all/c6268184-4904-49d9-b14f-0e11dce8bdad@app.fastmail.com/ This dead select was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha Link: $URL [1]" Acked-by: Arnd Bergmann Signed-off-by: Miquel Raynal --- drivers/mtd/maps/Kconfig | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig index dce5e67ce3c2..f44b098aa2cb 100644 --- a/drivers/mtd/maps/Kconfig +++ b/drivers/mtd/maps/Kconfig @@ -101,7 +101,6 @@ config MTD_PHYSMAP_IXP4XX depends on MTD_PHYSMAP_OF depends on ARM select MTD_COMPLEX_MAPPINGS - select MTD_CFI_BE_BYTE_SWAP if CPU_BIG_ENDIAN default ARCH_IXP4XX help This provides some extra DT physmap parsing for the Intel IXP4xx -- cgit v1.2.3